provider: ensure ExpiryWindow < TokenDuration

AliyunContainerService · Jul 29, 2024 · 0f0904e · 0f0904e
1 parent 8f32602
commit 0f0904e
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/pkg/credentials/provider/oidc_provider.go b/pkg/credentials/provider/oidc_provider.go
@@ -266,6 +266,9 @@ func (o *OIDCProviderOptions) applyDefaults() {
 	}
 	if o.ExpiryWindow == 0 {
 		o.ExpiryWindow = defaultExpiryWindowForAssumeRole
+		if o.TokenDuration > 0 && o.TokenDuration <= o.ExpiryWindow {
+			o.ExpiryWindow = o.TokenDuration / 2
+		}
 	}
 	if o.EnvRoleArn == "" {
 		o.EnvRoleArn = defaultEnvRoleArn

diff --git a/pkg/credentials/provider/provider.go b/pkg/credentials/provider/provider.go
@@ -20,5 +20,5 @@ type Stopper interface {
 
 func init() {
 	name := path.Base(os.Args[0])
-	UserAgent = fmt.Sprintf("%s %s/%s ack-ram-tool/%s", name, runtime.GOOS, runtime.GOARCH, runtime.Version())
+	UserAgent = fmt.Sprintf("%s %s/%s ack-ram-tool/provider/%s", name, runtime.GOOS, runtime.GOARCH, runtime.Version())
 }
diff --git a/pkg/credentials/provider/rolearn_provider.go b/pkg/credentials/provider/rolearn_provider.go
@@ -230,6 +230,9 @@ func (o *RoleArnProviderOptions) applyDefaults() {
 	}
 	if o.ExpiryWindow == 0 {
 		o.ExpiryWindow = defaultExpiryWindowForAssumeRole
+		if o.TokenDuration > 0 && o.TokenDuration <= o.ExpiryWindow {
+			o.ExpiryWindow = o.TokenDuration / 2
+		}
 	}
 	if o.Logger == nil {
 		o.Logger = defaultLog